US11888637B2 - Secure access for vCores - Google Patents

Secure access for vCores Download PDF

Info

Publication number
US11888637B2
US11888637B2 US17/323,691 US202117323691A US11888637B2 US 11888637 B2 US11888637 B2 US 11888637B2 US 202117323691 A US202117323691 A US 202117323691A US 11888637 B2 US11888637 B2 US 11888637B2
Authority
US
United States
Prior art keywords
vcores
gateway
container
access
distribution system
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US17/323,691
Other languages
English (en)
Other versions
US20220337445A1 (en
Inventor
Timothy DILLON
Shawn WARNER
Yao Zhidong
Jonathan Sawin
Karthik RAJALINGARI
Derek Gilmore
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Arris Enterprises LLC
Original Assignee
Arris Enterprises LLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Arris Enterprises LLC filed Critical Arris Enterprises LLC
Priority to US17/323,691 priority Critical patent/US11888637B2/en
Assigned to JPMORGAN CHASE BANK, N.A. reassignment JPMORGAN CHASE BANK, N.A. TERM LOAN SECURITY AGREEMENT Assignors: ARRIS ENTERPRISES LLC, COMMSCOPE TECHNOLOGIES LLC, COMMSCOPE, INC. OF NORTH CAROLINA
Assigned to JPMORGAN CHASE BANK, N.A. reassignment JPMORGAN CHASE BANK, N.A. ABL SECURITY AGREEMENT Assignors: ARRIS ENTERPRISES LLC, COMMSCOPE TECHNOLOGIES LLC, COMMSCOPE, INC. OF NORTH CAROLINA
Assigned to WILMINGTON TRUST reassignment WILMINGTON TRUST SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: ARRIS ENTERPRISES LLC, ARRIS SOLUTIONS, INC., COMMSCOPE TECHNOLOGIES LLC, COMMSCOPE, INC. OF NORTH CAROLINA, RUCKUS WIRELESS, INC.
Publication of US20220337445A1 publication Critical patent/US20220337445A1/en
Assigned to ARRIS ENTERPRISES LLC reassignment ARRIS ENTERPRISES LLC ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: GILMORE, DEREK, SAWIN, Jonathan, WARNER, SHAWN, ZHIDONG, Yao, DILLON, Timothy, RAJALINGARI, Karthik
Application granted granted Critical
Publication of US11888637B2 publication Critical patent/US11888637B2/en
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2801—Broadband local area networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H04L12/2869—Operational details of access network equipments
    • H04L12/2898—Subscriber equipments
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels

Definitions

  • the subject matter of this application relates to secure access to vCores.
  • Cable Television (CATV) services provide content to large groups of customers (e.g., subscribers) from a central delivery unit, generally referred to as a “head end,” which distributes channels of content to its customers from this central delivery unit through an access network comprising a hybrid fiber coax (HFC) cable plant, including associated components (nodes, amplifiers and taps).
  • HFC hybrid fiber coax
  • Modern Cable Television (CATV) service networks not only provide media content such as television channels and music channels to a customer, but also provide a host of digital communication services such as Internet Service, Video-on-Demand, telephone service such as VoIP, home automation/security, and so forth.
  • CATV head ends have historically included a separate Cable Modem Termination System (CMTS), used to provide high speed data services, such as cable Internet, Voice over Internet Protocol, etc. to cable customers and a video headend system, used to provide video services, such as broadcast video and video on demand (VOD).
  • CMTS Cable Modem Termination System
  • VOD video and video on demand
  • CMTS will include both Ethernet interfaces (or other more traditional high-speed data interfaces) as well as radio frequency (RF) interfaces so that traffic coming from the Internet can be routed (or bridged) through the Ethernet interface, through the CMTS, and then onto the RF interfaces that are connected to the cable company's hybrid fiber coax (HFC) system.
  • CMTS Cable Modem Termination System
  • RF radio frequency
  • Downstream traffic is delivered from the CMTS to a cable modem and/or set top box in a customer's home, while upstream traffic is delivered from a cable modem and/or set top box in a customer's home to the CMTS.
  • the Video Headend System similarly provides video to either a set-top, TV with a video decryption card, or other device capable of demodulating and decrypting the incoming encrypted video services.
  • CMTS Integrated Converged Cable Access Platform
  • I-CCAP Integrated Converged Cable Access Platform
  • distributed CMTS e.g., distributed Converged Cable Access Platform
  • R-PHY Remote PHY
  • PHY physical layer
  • R-MAC PHY relocates both the MAC and the PHY to the network's nodes
  • the R-PHY device in the remote node converts the downstream data sent from the core from digital-to-analog to be transmitted on radio frequency to the cable modems and/or set top boxes, and converts the upstream radio frequency data sent from the cable modems and/or set top boxes from analog-to-digital format to be transmitted optically to the core.
  • FIG. 1 illustrates an integrated Cable Modem Termination System.
  • FIG. 2 illustrates a distributed Cable Modem Termination System.
  • FIG. 3 illustrates a layered network processing stack.
  • FIG. 4 illustrates a server system with a resource allocation manager and a container orchestration system.
  • FIG. 5 illustrates a server system with containers and a container orchestration system.
  • FIG. 6 illustrates a set of vCores and a vCore management interface.
  • FIG. 7 illustrates a set of vCores and a gateway.
  • an integrated CMTS e.g., Integrated Converged Cable Access Platform (CCAP)
  • CCAP Integrated Converged Cable Access Platform
  • the integrated CMTS 100 may include data 110 that is sent and received over the Internet (or other network) typically in the form of packetized data.
  • the integrated CMTS 100 may also receive downstream video 120 , typically in the form of packetized data from an operator video aggregation system.
  • broadcast video is typically obtained from a satellite delivery system and pre-processed for delivery to the subscriber though the CCAP or video headend system.
  • the integrated CMTS 100 receives and processes the received data 110 and downstream video 120 .
  • the CMTS 130 may transmit downstream data 140 and downstream video 150 to a customer's cable modem and/or set top box 160 through a RF distribution network, which may include other devices, such as amplifiers and splitters.
  • the CMTS 130 may receive upstream data 170 from a customer's cable modem and/or set top box 160 through a network, which may include other devices, such as amplifiers and splitters.
  • the CMTS 130 may include multiple devices to achieve its desired capabilities.
  • D-CMTS Distributed Cable Modem Termination System
  • CCAP Distributed Converged Cable Access Platform
  • the D-CMTS 200 distributes a portion of the functionality of the I-CMTS 100 downstream to a remote location, such as a fiber node, using network packetized data.
  • An exemplary D-CMTS 200 may include a remote PHY architecture, where a remote PHY (R-PHY) is preferably an optical node device that is located at the junction of the fiber and the coaxial.
  • R-PHY remote PHY
  • the D-CMTS 200 may include a D-CMTS 230 (e.g., core) that includes data 210 that is sent and received over the Internet (or other network) typically in the form of packetized data.
  • the D-CMTS 200 may also receive downstream video 220 , typically in the form of packetized data from an operator video aggregation system.
  • the D-CMTS 230 receives and processes the received data 210 and downstream video 220 .
  • a remote Fiber node 280 preferably include a remote PHY device 290 .
  • the remote PHY device 290 may transmit downstream data 240 and downstream video 250 to a customer's cable modem and/or set top box 260 through a network, which may include other devices, such as amplifier and splitters.
  • the remote PHY device 290 may receive upstream data 270 from a customer's cable modem and/or set top box 260 through a network, which may include other devices, such as amplifiers and splitters.
  • the remote PHY device 290 may include multiple devices to achieve its desired capabilities.
  • the remote PHY device 290 primarily includes PHY related circuitry, such as downstream QAM modulators, upstream QAM demodulators, together with psuedowire logic to connect to the D-CMTS 230 using network packetized data.
  • the remote PHY device 290 and the D-CMTS 230 may include data and/or video interconnections, such as downstream data, downstream video, and upstream data 295 . It is noted that, in some embodiments, video traffic may go directly to the remote physical device thereby bypassing the D-CMTS 230 . In some cases, the remote PHY and/or remote MAC PHY functionality may be provided at the head end.
  • the remote PHY device 290 may covert downstream DOCSIS (i.e., Data Over Cable Service Interface Specification) data (e.g., DOCSIS 1.0; 1.1; 2.0; 3.0; 3.1; and 4.0 each of which are incorporated herein by reference in their entirety), video data, out of band signals received from the D-CMTS 230 to analog for transmission over RF or analog optics.
  • DOCSIS Data Over Cable Service Interface Specification
  • the remote PHY device 290 may convert upstream DOC SIS, and out of band signals received from an analog medium, such as RF or linear optics, to digital for transmission to the D-CMTS 230 .
  • the R-PHY may move all or a portion of the DOCSIS MAC and/or PHY layers down to the fiber node.
  • I-CMTS devices are typically custom built hardware devices that consist of a single chassis that include a series of slots, each of which receives a respective line card with a processor, memory, and other computing and networking functions supported thereon.
  • Each of the line cards include the same hardware configuration, processing capabilities, and software.
  • Each of the line cards performs the functions of the I-CMTS device, including the MAC and PHY functionality.
  • additional line cards are included with the system to expand the processing capability of the system.
  • a computing system may be, if desired, virtualized and operated using one or more COTS server, generally referred to herein as a virtual machine.
  • COTS server may operate with only a single operating system.
  • Each of the virtualized applications may then be isolated using software containers, such that the virtualized application may not see and are not aware of other virtualized applications operating on the same machine.
  • each COTS server includes one or more Intel/AMD processors (or other processing devices) with associated memory and networking capabilities running an operating system software.
  • the COTS servers include a framework and an operating system where user applications are run on such framework and the operating system is abstracted away from the actual operating system.
  • Each virtual machine may be instantiated and operated as one or more software applications running on a COTS server.
  • a plurality of software containers may be instantiated and operated on the same COTS server and/or the same virtual machine.
  • a plurality of COTS servers is typically included in one or more data centers, each of which are in communication with one another.
  • a plurality of COTS server may be located in different geographic areas to provide geo-redundancy.
  • the container may include the same functionality as a virtual machine, or vice versa.
  • a grouping of containerized components generally referred to as a pod, may be in the form of a virtual machine.
  • the COTS servers may be “bare metal” servers that typically include an operating system thereon together with drivers and a portion of a container orchestration system. One or more containers are then added to the “bare metal” server while being managed by the container orchestration system.
  • the container orchestration system described herein may likewise perform as, and be referred to as, a virtual machine orchestration system, as desired.
  • “bare metal” servers may be used with pods running on the operating system thereon together with drivers and a container orchestration system.
  • virtual machines may be omitted from the COTS servers.
  • Selected software processes that are included on a line card and/or a remote PHY device may be run on a “bare metal” server and/or virtual machine, including software containers, running on a COTS server, including both “active” and “back-up” software processes.
  • the functionality provided by such a “bare metal” server and/or virtual machine may include higher level functions such as for example, packet processing that includes routing Internet packet provisioning, layer 2 virtual private networking which operates over pseudowires, and multiprotocol label switching routing.
  • the functionality provided by such a “bare metal” server and/or virtual machine may include DOCSIS functions such as for example, DOCSIS MAC and encapsulation, channel provisioning, service flow management, quality of service and rate limiting, scheduling, and encryption.
  • the functionality provided by such a “bare metal” server and/or virtual machine may include video processing such as for example, EQAM and MPEG processing.
  • Each of the COTS servers and/or the virtual machines and/or software containers may contain different hardware profiles and/or frameworks.
  • each of the COTS servers and/or “bare metal” servers and/or virtual machines and/or software containers may execute on different processor types, different number of processing cores per processor, different amounts of memory for each processor type, different amounts of memory per processing core, different cryptographic capabilities, different amounts of available off-processor memory, different memory bandwidth (DDR) speeds, and varying types and capabilities of network interfaces, such as Ethernet cards.
  • DDR memory bandwidth
  • different COTS servers and/or “bare metal” servers and/or virtual machines and/or software containers may have different processing capabilities that vary depending on the particular hardware.
  • Each of the COTS servers and/or “bare metal” servers and/or the virtual machine and/or software containers may contain different software profiles.
  • each of the COTS servers and/or “bare metal” servers and/or virtual machines and/or software containers may include different software operating systems and/or other services running thereon, generally referred to herein as frameworks.
  • different COTS servers and/or “bare metal” servers and/or virtual machines and/or software containers may have different software processing capabilities that vary depending on the particular software profile.
  • the architecture of the hardware and/or software may be configured in the form of a plurality of different planes, each of which performing a different set of functionality.
  • the layered architecture may include different planes such as a management plane 300 , a control plane 310 , a data plane 320 , and switch fabric 330 to effectuate sending and receiving packets of data.
  • the management plane 300 may be generally considered as the user interaction or otherwise the general software application being run.
  • the management plane typically configures, monitors, and provides management, and configuration served to all layers of the network stack and other portions of the system.
  • control plane 310 is a component to a switching function that often includes system configuration, management, and exchange of routing table information and forwarding information. Typically, the exchange of routing table information is performed relatively infrequently.
  • a route controller of the control plane 310 exchanges topology information with other switches and constructs a routing table based upon a routing protocol.
  • the control plane may also create a forwarding table for a forwarding engine.
  • the control plane may be thought of as the layer that makes decisions about where traffic is sent. Since the control functions are not performed on each arriving individual packet, they tend not to have a strict speed constraint.
  • the data plane 320 parses packet headers for switching, manages quality of service, filtering, medium access control, encapsulations, and/or queuing.
  • the data plane carriers the data traffic, which may be substantial in the case of cable distribution networks.
  • the data plane may be thought of as the layer that primarily forwards traffic to the next hop along the path to the selected destination according to the control plane logic through the switch fabric. The data plane tends to have strict speed constraints since it is performing functions on each arriving individual packet.
  • the switch fabric 330 provides a network topology to interconnect network nodes via one or more network switches.
  • additional COTS servers and/or “bare metal” servers and/or virtual machines and/or software containers are included with the system to expand the processing capability of the overall system.
  • one or more additional COTS servers and/or “bare metal” servers and/or virtual machines and/or software containers may be included that are assigned as “back-up” which are exchanged for an “active” process upon detection of a failure event.
  • the scaling of the data plane 320 on COTS servers and/or “bare metal” servers and/or virtual machines and/or software containers to service dynamically variable processing requirements should be performed in such a manner that ensures sufficiently fast processing of data packets and sufficient bandwidth for the transmission of the data packets to ensure they are not otherwise lost.
  • a virtualized Remote PHY MAC Core may be referred to herein as a vCore instance.
  • containers 410 Each of the containers are isolated from one another and bundle their own software, libraries, and configuration files.
  • the containers may communicate with one another using defined channels.
  • one or more applications and its dependencies may be packed in a virtual container that can run on a COTS server and/or “bare metal” server and/or a virtual machine.
  • This containerization increases the flexibility and portability on where the application may run, such as an on-premises COTS server, a “bare metal” server, a public cloud COTS server, a private cloud COTS server, or otherwise.
  • a single COTS server and/or “bare metal” server and/or a virtual machine operating on a COTS server and/or “bare metal” server may run several containers simultaneously.
  • the COTS server and/or “bare metal” server and/or the virtual machine and/or the containers may be distributed within the cable distribution system.
  • a COTS server and/or “bare metal” server and/or a virtual machine may include a container orchestration system 420 for automating the application deployment, scaling, and management of the containers 410 across one or more COTS servers and/or “bare metal” servers and/or virtual machines.
  • the computing device running the container orchestration system 420 is separate from the computing device providing the containers for the dataplane applications.
  • the virtual machine illustrated in FIG. 4 may be omitted, such as the COTS B.
  • the application deployment, scaling, and management of the containers may include clusters across multiple hosts, such as multiple COTS servers.
  • the deployment, maintaining, and scaling, of the containers may be based upon characteristics of the underlying system capabilities, such as different processor types, different number of processing cores per processor, different amounts of memory for each processor type, different amounts of memory per processing core, different amounts of available off-processor memory, different memory bandwidth (DDR) speeds, different frameworks, and/or varying types and capabilities of network interfaces, such as Ethernet cards.
  • characteristics of the underlying system capabilities such as different processor types, different number of processing cores per processor, different amounts of memory for each processor type, different amounts of memory per processing core, different amounts of available off-processor memory, different memory bandwidth (DDR) speeds, different frameworks, and/or varying types and capabilities of network interfaces, such as Ethernet cards.
  • DDR memory bandwidth
  • the container orchestration system 420 may allocate different amounts of the underlying system capabilities, such as particular processor types, a selected number of processors (e.g., 1 or more), a particular number of processing cores per selected processor, a selected amount of memory for each processor type, a selected amount of memory per processing core, a selected amount of available off-processor memory, a selected framework, and/or a selected amount and/or type of network interface(s), such as Ethernet cards.
  • a corresponding agent for the container orchestration system 420 may be included on each COTS server (e.g., COTS A and/or COTS B).
  • the container orchestration system 420 may include a grouping of containerized components, generally referred to as a pod 430 .
  • a pod consists of one or more containers that are co-located on the same COTS server and/or “bare metal” server and/or the same virtual machine, which can share resources of the same COTS server and/or “bare metal” server and/or same virtual machine.
  • Each pod 430 is preferably assigned a unique pod IP address within a cluster, which allows applications to use ports without the risk of conflicts.
  • each of the containers may reference each other based upon a localhost or other addressing service, but a container within one pod preferably has no way of directly addressing another container within another pod, for that, it preferably uses the pod IP address or otherwise an addressing service.
  • a traditional D-CMTS RPHY Core may be implemented as a specialty built appliance including both software and hardware to achieve desired performance characteristics, such as ensuring the timing of the transfer of data packets.
  • the specially built appliance is not amenable to automatic deployment nor automatic scaling due to the fixed nature of its characteristics.
  • the vCore instance is preferably implemented in software operating on a COTS server and/or “bare metal” server on top of an operating system, such as Linux.
  • the vCore instance is preferably implemented in a manner that readily facilitates automation techniques such as lifecycle management, flexible scaling, health monitoring, telemetry, etc.
  • vCore instance on a COTS server and/or “bare metal” server tends to result in several challenges, mostly related to the data plane components.
  • One of the principal challenges involves ensuring that data is provided to the network in a timely and effective manner to achieve the real time characteristics of a cable data distribution environment.
  • the cable data distribution environment includes real time constraints on the timing of data packet delivery, which is not present in typical web-based environments or database environments.
  • Each vCore instance is preferably implemented within a container, where the size (e.g., scale, memory, CPU, allocation, etc.) of each container translates into the amount of server hardware and software resources assigned to the particular vCore instance.
  • the amount of server hardware and software resources assigned to each particular vCore instance is preferably a function of the number of groups of customers (e.g., service groups) and/or number of customers that the vCore instance can readily provide RPHY MAC Core services to. For example, a limited amount of server hardware and software resources may be assigned to a particular vCore instance that has a limited number of groups of customers and/or customers.
  • a substantial amount of server hardware and software resources may be assigned to a particular vCore instance that has a substantial number of groups of customers and/or customers.
  • selected server hardware resources are preferably allocated among the different vCore instances in a non-overlapping manner so that each vCore instance has a dedicated and predictable amount of server hardware resources.
  • selected software resources are preferably allocated among the different vCore instances in a non-overlapping manner so that each vCore instance has a dedicated and predictable amount of software resources.
  • the number of CPU cores preferably assigned to each vCore instance may be a function of the total USSG (upstream service groups—groups of customer modems and/or set top boxes) (USsg) and the total DSSG (downstream service groups—groups of customer modems and/or set top boxes) (DSsg) connected through that vCore instance.
  • Other hardware and/or software characteristics may likewise be assigned, as desired.
  • the scaling of the vCore instance may refer to the capability to automatically create and deploy a vCore instance within a container on a COTS server and/or “bare metal” server and/or virtual machine that is appropriately sized to serve a particular set of remote physical devices and/or service groups (e.g., sets of cable customers) and/or cable customers.
  • the scaling of the vCore instance may also include, in some cases, the capability to automatically modify the hardware and/or software characteristics of an existing vCore instance within a container on a COTS server and/or “bare metal” server and/or virtual machine to be appropriately sized to serve a modified particular set of remote physical devices and/or service groups (e.g., sets of cable customers) and/or cable customers.
  • a resource allocation manager 470 may assign or reallocate a suitable amount of hardware and software of the COTS server and/or “bare metal” server resources to each particular vCore instance (e.g., CPU cores, and/or memory, and/or network capacity).
  • the amount of such COTS server and/or “bare metal” server hardware and software resources assigned to or reallocate to each vCore instance may be a function of its scale and also other features, such as various other resource allocations.
  • a corresponding agent for the resource allocation manager 470 may be included on each COTS server (e.g., COTS A, COTS B).
  • the vCore instance includes data plane software for the transfer of data packets and other functions of the data plane.
  • the data plane software may include a set of data plane libraries and network interface controller (NIC) drivers that are used to manage the data packets for the data plane.
  • NIC network interface controller
  • the data plane software operates in user space, as opposed to Kernel space like typical network processing software, thus it does not make use of the operating system kernel and container management network drivers and plugins.
  • the data plane software may include a queue manager, a buffer manager, a memory manager, and/or a packet framework for packet processing.
  • the data plane software may use CPU cores that are isolated from the Kernel, meaning that the operating system scheduled processes are not running on these isolated CPU cores.
  • the separation of the CPU cores between the data plane software and the operating system software ensures that tasks performed by the operating system software does not interfere with the data plane software processing the data packets in a timely manner.
  • the separation of the CPU cores between the data plane software and the operating system software enables both to use the same physical central processing unit, albeit different cores, of the same physical central processing unit.
  • other hardware and/or software capabilities may likewise be separated, such as for example, selected processors (e.g., 1 or more), particular number of processing cores per selected processor, selected amount of memory for each processor type, selected amount of memory per processing core, selected amount of available off-processor memory, selected framework, and/or selected amount and/or type of network interface(s).
  • each vCore instance may have dedicated network bandwidth capability apart from other vCore instances and the operating system software.
  • the physical network interface cards may be virtualized so that a plurality of different software applications can make use of the same network interface card, each with a guaranteed amount of bandwidth available.
  • the network interface cards are preferably virtualized using a single root input/output virtualization technique (SR-IOV).
  • the SR-IOV partitions the NIC physical functions (e.g., PFs) into one or more virtual functions (VFs).
  • PFs physical functions
  • VFs virtual functions
  • the capabilities of the PFs and VFs are generally different.
  • the PF supports queues, descriptions, offloads, hardware lock, hardware link control, etc.
  • the VF supports networking features based upon queues and descriptors.
  • the automated creation, deployment, and removal of vCore instances may be performed by the container orchestration system 420 .
  • the vCore instances 530 may operate on a COTS server and/or “bare metal” server 500 acting as a remote PHY MAC core for one or more remote physical devices connected over a converged interconnect network, normally located in the same hub.
  • the vCore instances 530 may include data plane software 532 .
  • Each of the vCore instances 530 as generally referred to as a POD. In some cases, multiple vCores may be included in a POD.
  • the COTS server 500 may communicate with the Internet 560 , a set of networking switches 570 , to remote physical devices 580 , and the customers 590 .
  • the COTS server and/or “bare metal” server including the vCore instances operating thereon is typically a relatively high performance server that has one or more of the following characteristics:
  • At least one management NIC 510 is connected to, usually, a separate management network 512 .
  • the management NIC 510 is primarily used for orchestration and management of the server application, which may also manage the data traffic.
  • At least two (for redundancy) data plane NICs 514 i.e., data plane physical network interfaces
  • SR-IOV and PTP (IEEE 1588) 522 are included for hardware timestamping capabilities of the data packets.
  • the data plane NICs 514 are used to provide connectivity to the remote physical devices and the customer modems and/or set top boxes/consumer premises equipment behind such remote physical devices.
  • the vCore instances 530 may each include a virtual function 534 network interface to each of the data plane NICs 514 .
  • the hardware may include dedicated devices for DES encryption.
  • the operating system on the COTS server and/or “bare metal” server is a LINUX OS such as Ubuntu, Redhat, etc.
  • the COTS Server and/or “bare metal” server and/or virtual machine includes container software.
  • the COTS Server and/or “bare metal” server and/or virtual machine and/or other server includes at least a part of a container orchestration system.
  • the COTS Server and/or “bare metal” server and/or virtual machine and/or other server includes a resource allocation manager (RAM) 520 that manages, at least in part, the server allocation of software and/or hardware resources for vCore instances, including for example: CPU Cores, memory, VFs, MAC addresses, etc.
  • the RAM 520 may also provide server configuration, including OS configuration, driver support, etc., diagnostics and health monitoring.
  • the COTS Server and/or “bare metal” server and/or virtual machine and/or other server may include an orchestration app 540 that manages, at least in part, the management of the vCores (e.g., containers and/or pods).
  • the COTS Server and/or “bare metal” server and/or virtual machine and/or other server may run the PTP application 522 that synchronizes the system clock of the COTS Server and/or “bare metal” server and/or virtual machine and/or vCore instances 520 based upon a grand master clock for the system as a whole.
  • the PTP application 522 is preferably based upon hardware time stamping and a Precise Hardware Clock that is present on the NICs 514 .
  • the vCore preferably performs the MAC layer functionality.
  • each of the vCores 600 traditionally includes a command line interface 610 to receive instructions thereto for configuration, diagnostics, control, and management.
  • the command line interface processes commands in the form of lines of text.
  • a command line interface may be provided using a shell to provide interactive access to the corresponding operating system functions or services.
  • a plurality of vCores, such as 32 vCores, may be installed on a COTS Server and/or “bare metal” server and/or virtual machine and/or other server 620 (generally referred to herein as a “server”).
  • Each of the vCores 600 on the server 620 includes a respective command line interface 610 .
  • a vCore management interface 630 provides access to each of the respective vCores 700 , such as opening up a respective terminal window, to facilitate access to the respective command line interface 610 .
  • an operator may open a terminal window to access the command line interface on a first vCore and execute commands thereon.
  • bidirectional interactive text-oriented communications may be used for such command execution, such as Telnet.
  • diagnostics, control, and management for each of the vCores at least 32 such terminal windows are opened and 32 sets of commands are executed.
  • the vCores are preferably instantiated within a respective POD within a Kubernetes infrastructure.
  • Kubernetes is primarily designed for the horizontally scaled deployment of microservices, especially for load balancing.
  • the vCores preferably do not include an externally visible endpoint external to the POD/Kubernetes infrastructure.
  • it is not desirable to include an externally visible endpoint to each vCore due to limitations in the number of available such externally visible endpoints (e.g., IP addresses within a name space), the management of such externally visible endpoints, and security considerations.
  • vCores providing data plane services within the POD/Kubernetes infrastructure it is desirable to have addressable access to the data plane services of each respective vCore.
  • Previously existing tools for managing a CMTS are not well adapted to the management of vCores within the POD/Kubernetes infrastructure due, in part, to the absence of a unique externally addressable interface to the POD/Kubernetes infrastructure (aka externally addressable IP address). Accordingly, the POD/Kubernetes infrastructure with vCores hosted thereon does not include out of band management capabilities.
  • a virtual network interface 700 which is an abstract virtualized representation of a computer network interface, as part of a gateway 710 .
  • Each of the vCores includes an internally accessible service endpoint that is accessible internally to the POD/Kubernetes infrastructure, and not directly accessible externally to the POD/Kubernetes infrastructure.
  • the service endpoint of a vCore may be vCore1.123.Cable-Network.Service-endpoint and the service endpoint of another vCore may be vCore2.123.Cable-Network.Service-endpoint.
  • the gateway 710 using the virtual network interface 700 in combination with a Kubernetes Domain Name System Controller 740 included within the POD/Kubernetes infrastructure, resolves the location/access of the respective vCore. In this manner, each vCore is mapped to the gateway 710 with an internally accessible service endpoint, while each vCore is not mapped with an externally accessible service endpoint (e.g., not externally routable) to the POD/Kubernetes infrastructure.
  • the commands that are provided within the POD/Kubernetes infrastructure to the vCores from the gateway are preferably non-encrypted text, which are suitable for traditional management tools. Moreover, by limiting such non-encrypted text being exchanged from within the POD/Kubernetes infrastructure it is not prone to security concerns.
  • the gateway 710 While non-encrypted exchanges are permitted between the gateway 710 and the vCores within the POD/Kubernetes infrastructure, the gateway 710 includes one or more externally accessible service endpoints to the POD/Kubernetes infrastructure (e.g., IP address) that only permits encrypted exchanges, such as through a secure socket shell, across an unsecured network (e.g., the Internet) from a computer 750 . As it may be observed, the gateway within the POD/Kubernetes infrastructure performs as an aggregation point for the internal vCores to be accessed by an external computer.
  • IP address e.g., IP address
  • the gateway also permits the use of non-encrypted scripts to provide configuration, diagnostics, control, and management of the vCores in an efficient manner while access to the gateway is provided in an encrypted manner.
  • the service ports for the telnet communications may be managed as a pool resource with a configurable fixed pool size that are shared across multiple telnet sessions which terminate on the same vCore. A service port may be removed once all sessions using it have terminated.
  • the gateway is preferably configured with the configuration, diagnostics, control, and management software that is used to communicate with the vCores.
  • the external connection to the gateway is configured in a such a manner that any attempt to run any other command within the restricted shell results in immediate termination of the shell/user's session with the gateway.
  • Authentication of external access to the gateway may be dependent upon credentials.
  • the command line access using the external secure socket shell permits access by name to a vCore, access that may be filtered by node name, and access using a full list of available vCores.
  • the access route from the gateway may be provided by a dynamically created Kubernetes service route from the gateway to the vCore.
  • Existing service routes may be (re)used when currently instantiated and not torn down when still in use, or otherwise cleaned up.
  • the terminal configuration may be preserved such that command line interface command expansion/extension, history, and help features are preserved.
  • the gateway logs the user name, access time on login, and the user name and exit time upon exiting the application/service.
  • additional software may be included to complement the gateway to allow users to automate the running of configuration and diagnostic scripts through the gateway at the target vCore(s) and to return the results.
  • each functional block or various features in each of the aforementioned embodiments may be implemented or executed by a circuitry, which is typically an integrated circuit or a plurality of integrated circuits.
  • the circuitry designed to execute the functions described in the present specification may comprise a general-purpose processor, a digital signal processor (DSP), an application specific or general application integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic, or a discrete hardware component, or a combination thereof.
  • the general-purpose processor may be a microprocessor, or alternatively, the processor may be a conventional processor, a controller, a microcontroller or a state machine.
  • the general-purpose processor or each circuit described above may be configured by a digital circuit or may be configured by an analogue circuit. Further, when a technology of making into an integrated circuit superseding integrated circuits at the present time appears due to advancement of a semiconductor technology, the integrated circuit by this technology is also able to be used.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)
US17/323,691 2021-04-20 2021-05-18 Secure access for vCores Active 2041-10-15 US11888637B2 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/323,691 US11888637B2 (en) 2021-04-20 2021-05-18 Secure access for vCores

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US202163177310P 2021-04-20 2021-04-20
US17/323,691 US11888637B2 (en) 2021-04-20 2021-05-18 Secure access for vCores

Publications (2)

Publication Number Publication Date
US20220337445A1 US20220337445A1 (en) 2022-10-20
US11888637B2 true US11888637B2 (en) 2024-01-30

Family

ID=76624118

Family Applications (1)

Application Number Title Priority Date Filing Date
US17/323,691 Active 2041-10-15 US11888637B2 (en) 2021-04-20 2021-05-18 Secure access for vCores

Country Status (5)

Country Link
US (1) US11888637B2 (fr)
EP (1) EP4327519A1 (fr)
JP (1) JP2024515685A (fr)
CA (1) CA3215998A1 (fr)
WO (1) WO2022225541A1 (fr)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230359951A1 (en) * 2022-05-05 2023-11-09 Microsoft Technology Licensing, Llc Seat-assignment based resource tracking

Citations (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102055737A (zh) * 2009-11-04 2011-05-11 中兴通讯股份有限公司 一种远程登陆多核系统硬件线程的方法、装置及系统
US20130152194A1 (en) * 2011-12-07 2013-06-13 Computer Associates Think, Inc. System, method and software for controlling access to virtual machine consoles
US20150092531A1 (en) * 2013-09-30 2015-04-02 Cisco Technology, Inc. Virtual cable modem termination system
US20150121377A1 (en) * 2013-10-31 2015-04-30 Huawei Technologies Co., Ltd. Method for implementing inter-virtual processor interrupt, related apparatus, and system
US20150212902A1 (en) * 2014-01-27 2015-07-30 Nigel David Horspool Network attached storage device with automatically configured distributed file system and fast access from local computer client
US20170244577A1 (en) 2016-02-22 2017-08-24 Harmonic, Inc. Virtual converged cable access platform (ccap) core
US20180063103A1 (en) * 2016-08-26 2018-03-01 Nicira, Inc. Secure key management protocol for distributed network encryption
US20180302299A1 (en) * 2017-04-14 2018-10-18 Futurewei Technologies, Inc. Networking service level agreements for computer datacenters
US20180375897A1 (en) * 2017-06-26 2018-12-27 Formaltech, Inc. Automated network device cloner and decoy generator
US20190007378A1 (en) * 2017-06-28 2019-01-03 Microsoft Technology Licensing, Llc Shielded networks for virtual machines
US20190124407A1 (en) * 2017-10-20 2019-04-25 Cisco Technology, Inc. Virtual Cable Modem Termination System Redundancy
US10567288B1 (en) * 2017-11-28 2020-02-18 Juniper Networks, Inc. Automatic discovery, scaling, and load balancing of multiple cloud data centers in a software-defined network environment
WO2021006621A1 (fr) 2019-07-08 2021-01-14 엘지전자 주식회사 Codage de vidéo ou d'image basé sur un filtre à boucle adaptatif
US20210136050A1 (en) * 2019-11-04 2021-05-06 Harmonic, Inc. Secured Transport in Remote MAC/PHY DAA Architecture
US20220103455A1 (en) * 2020-09-30 2022-03-31 Vmware, Inc. Incremental and parallel routing domain computation

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021066621A1 (fr) * 2019-10-04 2021-04-08 Samsung Electronics Co., Ltd. Plateforme infonuagique intelligente pour héberger une fonction réseau de périphérie efficace en ressources

Patent Citations (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102055737A (zh) * 2009-11-04 2011-05-11 中兴通讯股份有限公司 一种远程登陆多核系统硬件线程的方法、装置及系统
US20130152194A1 (en) * 2011-12-07 2013-06-13 Computer Associates Think, Inc. System, method and software for controlling access to virtual machine consoles
US20150092531A1 (en) * 2013-09-30 2015-04-02 Cisco Technology, Inc. Virtual cable modem termination system
US20150121377A1 (en) * 2013-10-31 2015-04-30 Huawei Technologies Co., Ltd. Method for implementing inter-virtual processor interrupt, related apparatus, and system
US20150212902A1 (en) * 2014-01-27 2015-07-30 Nigel David Horspool Network attached storage device with automatically configured distributed file system and fast access from local computer client
US20170244577A1 (en) 2016-02-22 2017-08-24 Harmonic, Inc. Virtual converged cable access platform (ccap) core
US20180063103A1 (en) * 2016-08-26 2018-03-01 Nicira, Inc. Secure key management protocol for distributed network encryption
US20180302299A1 (en) * 2017-04-14 2018-10-18 Futurewei Technologies, Inc. Networking service level agreements for computer datacenters
US20180375897A1 (en) * 2017-06-26 2018-12-27 Formaltech, Inc. Automated network device cloner and decoy generator
US20190007378A1 (en) * 2017-06-28 2019-01-03 Microsoft Technology Licensing, Llc Shielded networks for virtual machines
US20190124407A1 (en) * 2017-10-20 2019-04-25 Cisco Technology, Inc. Virtual Cable Modem Termination System Redundancy
US10567288B1 (en) * 2017-11-28 2020-02-18 Juniper Networks, Inc. Automatic discovery, scaling, and load balancing of multiple cloud data centers in a software-defined network environment
WO2021006621A1 (fr) 2019-07-08 2021-01-14 엘지전자 주식회사 Codage de vidéo ou d'image basé sur un filtre à boucle adaptatif
US20210136050A1 (en) * 2019-11-04 2021-05-06 Harmonic, Inc. Secured Transport in Remote MAC/PHY DAA Architecture
US20220103455A1 (en) * 2020-09-30 2022-03-31 Vmware, Inc. Incremental and parallel routing domain computation

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
DVB Organization : "SCTE ARRIS Virtualized CCAP.pdf", DVB, Digital Video Broadcasting, C/O EBU—17A Ancienne Route—CH-1218 Grans Saconnex, Geneva—Switzerland, Oct. 26, 2017 (Aug. 26, 2017) paragraphs [0013]—[0042]; claim 1.
Emmendorfer, Michael J: "WB1.2—Cable Operator's Access Architecture from Aggregation to Disaggregation and Distributed (Plenary)", 2019 IEEE, Jul. 8, 2019 (Jul. 8, 2019), p. 1, XP033598365, DOI: 10.1109/PHOSST.2019.8795043 [retrieved on Aug. 12, 2019] the whole document.
International Search Report and Written Opinion RE: Application No. PCT/US2021/033002, dated Dec. 13, 2021.

Also Published As

Publication number Publication date
CA3215998A1 (fr) 2022-10-27
US20220337445A1 (en) 2022-10-20
EP4327519A1 (fr) 2024-02-28
JP2024515685A (ja) 2024-04-10
WO2022225541A1 (fr) 2022-10-27

Similar Documents

Publication Publication Date Title
US11916690B2 (en) Automated lifecycle management with flexible scaling and dynamic resource allocation for virtualized cable data plane applications
US8477620B2 (en) System and method to provide multiple private networks using PBB
US8582580B2 (en) System and method to provide multiple private networks using PBB/TE
US11888637B2 (en) Secure access for vCores
US11855835B2 (en) Availability and redundancy for vCores
US20240137611A1 (en) Installation and scaling for vcores
US10270660B2 (en) Function virtualization for multimedia network topology adaptation
US20220385962A1 (en) License management for vcores
US11811581B2 (en) IPDR communication system for virtualized core sources
US11528331B2 (en) Management system for vCores
CA3231149A1 (fr) Manipulation de fichiers pour c?urs virtuels

Legal Events

Date Code Title Description
FEPP Fee payment procedure

Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

AS Assignment

Owner name: JPMORGAN CHASE BANK, N.A., NEW YORK

Free format text: ABL SECURITY AGREEMENT;ASSIGNORS:ARRIS ENTERPRISES LLC;COMMSCOPE TECHNOLOGIES LLC;COMMSCOPE, INC. OF NORTH CAROLINA;REEL/FRAME:058843/0712

Effective date: 20211112

Owner name: JPMORGAN CHASE BANK, N.A., NEW YORK

Free format text: TERM LOAN SECURITY AGREEMENT;ASSIGNORS:ARRIS ENTERPRISES LLC;COMMSCOPE TECHNOLOGIES LLC;COMMSCOPE, INC. OF NORTH CAROLINA;REEL/FRAME:058875/0449

Effective date: 20211112

AS Assignment

Owner name: WILMINGTON TRUST, DELAWARE

Free format text: SECURITY INTEREST;ASSIGNORS:ARRIS SOLUTIONS, INC.;ARRIS ENTERPRISES LLC;COMMSCOPE TECHNOLOGIES LLC;AND OTHERS;REEL/FRAME:060752/0001

Effective date: 20211115

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

STPP Information on status: patent application and granting procedure in general

Free format text: AWAITING TC RESP., ISSUE FEE NOT PAID

STPP Information on status: patent application and granting procedure in general

Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS

AS Assignment

Owner name: ARRIS ENTERPRISES LLC, GEORGIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DILLON, TIMOTHY;WARNER, SHAWN;ZHIDONG, YAO;AND OTHERS;SIGNING DATES FROM 20210519 TO 20231013;REEL/FRAME:065300/0130

STPP Information on status: patent application and granting procedure in general

Free format text: PUBLICATIONS -- ISSUE FEE PAYMENT VERIFIED

STCF Information on status: patent grant

Free format text: PATENTED CASE